hush

Secure P2P secret sharing with zero servers

What is hush?

hush (like probably a thousand other tools) lets you share secrets (passwords, API keys, tokens) and files directly between two machines with end-to-end encryption and zero trust in any server infrastructure.

How it works:

1. Sender runs hush send <secret> or hush send-file <file> and gets a one-time code (e.g., 14-fleshlessness-latinesque)
2. Sender shares the code out-of-band (Slack, in person, etc.) with the receiver
3. Receiver runs hush receive <code> to establish a direct encrypted connection
4. Secret/file transfers peer-to-peer, then both sides discard all session data

The code acts as both a discovery mechanism and the encryption password. Because it's shared out-of-band (not over the same channel as the encrypted data), an attacker would need to compromise both channels to decrypt the secret.

Security

• End-to-End Encryption: PAKE (Password-Authenticated Key Exchange) + AES-GCM
• Zero Trust: No relay servers, no intermediaries, no logs
• Out-of-band verification: Code shared separately from encrypted channel
• Ephemeral: One-time codes, session keys discarded after use
• No persistence: Nothing stored on disk, no history

Threat model:

• ✅ Protects against network eavesdropping
• ✅ Protects against MITM if attacker doesn't have the code
• ✅ Protects against compromised servers (there are none)
• ⚠️ Does not protect against compromised endpoints
• ⚠️ Assumes out-of-band channel is secure

Network Support

Works:

• ✅ Same local network (WiFi/Ethernet) - auto-discovery
• ✅ Any network with direct peer-to-peer routing

Does not work:

• ❌ Restrictive corporate firewalls blocking P2P
• ❌ Public internet across NATs (no relay servers)
• ❌ Networks blocking both UDP broadcast and TCP connections

Installation

Prerequisite: go 1.25

You should just be able to do

brew install go

# Clone and install
git clone <repo>
cd hush
./install.sh

The install script will automatically detect your platform and build the appropriate binary.

Quick Start

# Sender (machine A)
$ hush send "my-secret-password"

Your code: 14-fleshlessness-latinesque

Waiting for connection...

# Receiver (machine B, same network)
$ hush receive 14-fleshlessness-latinesque

Secret copied to clipboard!

Usage

hush supports two connection modes:

1. Auto-discovery (same local network)

Uses UDP broadcast to automatically discover the sender. Works when both machines are on the same WiFi/LAN.

# Sender
$ hush send "my-secret"

Your code: 59-theorbist-calico

On same network:
  hush receive 59-theorbist-calico

Waiting for connection...

# Receiver
$ hush receive 59-theorbist-calico

Waiting for sender...
Secret copied to clipboard!

2. Manual IP (VPN)

Use -ip flag to connect directly without UDP discovery. Necessary when:

• Machines are in different physical locations (e.g., cross-office via VPN)
• Network doesn't support broadcast
• Firewall blocks UDP

# Sender shows their IP
$ hush send "my-secret"

Your code: 59-theorbist-calico

Across offices:
  hush receive -ip=17.243.206.235 59-theorbist-calico

# Receiver connects directly
$ hush receive -ip=17.243.206.235 59-theorbist-calico

Connecting to 17.243.206.235...
Secret copied to clipboard!

Additional Options

Print to terminal (for scripting/automation):

$ hush receive --print 59-theorbist-calico

Received secret:
my-secret-password

Combine flags:

$ hush receive -ip=17.243.206.235 --print 59-theorbist-calico

File Transfer

Send files up to 10MB (config files, SSH keys, certificates, etc.):

# Sender
$ hush send-file config.json

Your code: 42-wandering-telescope

On same network:
  hush receive 42-wandering-telescope

Waiting for connection...

# Receiver (same network)
$ hush receive 42-wandering-telescope

Waiting for sender...
File saved: hush_1704123456.json (original: config.json)

# Receiver (different office)
$ hush receive -ip=17.243.206.235 42-wandering-telescope

Connecting to 17.243.206.235...
File saved: hush_1704123789.json (original: config.json)

Note: Files are saved to the current working directory as hush_[timestamp].[ext] to prevent accidental overwrites and path traversal attacks. The original filename is displayed for reference.

Encrypted Chat

Have a secure, ephemeral conversation with end-to-end encryption. Messages are encrypted in real-time and nothing is logged or stored.

# Sender (machine A)
$ hush chat

Your code (copied to clipboard): 23-luminous-firefly

On same network:
  hush chat 23-luminous-firefly

Across offices:
  hush chat -ip=17.243.206.235 23-luminous-firefly

Waiting for connection...

==================================================
✓ Connected! Type your messages (Ctrl+D or Ctrl+C to quit)
==================================================

> Hey, got the deploy keys?
< Yeah sending them now via hush send-file
> Perfect, thanks!

==================================================
Chat ended.
==================================================

# Receiver (machine B, same network)
$ hush chat 23-luminous-firefly

==================================================
✓ Connected! Type your messages (Ctrl+D or Ctrl+C to quit)
==================================================

< Hey, got the deploy keys?
> Yeah sending them now via hush send-file
< Perfect, thanks!

==================================================
Chat ended.
==================================================

# Receiver (different office, VPN)
$ hush chat -ip=17.243.206.235 23-luminous-firefly

Features:

• Bidirectional encrypted messaging (same PAKE + AES-GCM as secrets/files)
• Messages grouped by sender for clean output
• No logs, no history, ephemeral by design
• Works with auto-discovery or manual IP (-ip flag)
• Exit with Ctrl+D or Ctrl+C

More Examples

For detailed examples and use cases, run:

$ hush examples